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Disclosure Statement ("EDS") for consideration by the Examiner. The patents, publications or 
other information submitted for consideration by the Patent Office are listed on Form PTO-1449, 
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publication or that portion which caused it to be listed; and (iii) all other information or that 
portion which caused it to be listed. 

Except as may be indicated below, all of the patents, publications or other information are 
in the English language, a copy of which is attached hereto and therefore, a concise explanation 
of each reference is not required. The following additional information is provided for the 
Examiner's consideration. 



I hereby certify that this correspondence is being deposited with the United States Postal Service as first 
class mail in an envelope addressed to: Mail Stop Amendment, Commissioner for Patents, P.O. Box 
1450, Alexandria, VA 22313-1450, on September 23, 2005. 
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To assist the Examiner in reviewing this EDS, the Applicant has conducted a key word 
search of each U.S. patent and U.S. patent application publication listed on the attached Form 
PTO-1449. The Applicant used the following search terms in his query of the U.S. patents and 
U.S. patent application publications: (1) "computer$"; (2) "intrusion$", (3) "detect$", (4) 
"(classif$ or type or types)", (5) "(signatures or context$)" and (6) "(store$ or save or saved or 
record$)." The Applicant used Boolean logic when performing this search in which each term 
was linked by the logical connector "AND." A search of these U.S. patents and U.S. patent 
application publications using the aforementioned terms and Boolean search logic yielded the 
following results (33 patents and 8 publications): 



U.S. PATENTS 

U.S. Patent No. 5,278,901 to Shieh et al. 

U.S. Patent No. 5,414,833 to Hershey et al. 

U.S. Patent No. 5,440,723 to Arnold et al. 

U.S. Patent No. 5,557,742 to Smaha et al. 

U.S. Patent No. 5,919,258 to Kayashima et al. 

U.S. Patent No. 6,088,804 to Hill et al. 

U.S. Patent No. 6,275,942 to Bernhard et al. 

U.S. Patent No. 6,279,113 to Vaidya 

U.S. Patent No. 6,282,546 to Gleichauf et al. 

U.S. Patent No. 6,298,445 to Shostack et al. 

U.S. Patent No. 6,301,668 to Gleichauf et al. 

U.S. Patent No. 6,321,338 to Porras et al. 

U.S. Patent No. 6,324,647 to Bowman- Amuah 

U.S. Patent No. 6,347,374 to Drake et al. 

U.S. Patent No. 6,353,385 to Molini et al. 

U.S. Patent No. 6,405,318 to Rowland 

U.S. Patent No. 6,405,364 to Bowman-Amuah 

U.S. Patent No. 6,415,321 to Gleichauf et al. 

U.S. Patent No. 6,460,141 to Olden 

U.S. Patent No. 6,477,651 to Teal 

U.S. Patent No. 6,484,203 to Porras et al. 

U.S. Patent No. 6,487,666 to Shanklin et al. 

U.S. Patent No. 6,499,107 to Gleichauf et al. 

U.S. Patent No. 6,578,147 to Shanklin et al. 

U.S. Patent No. 6,606,744 to Mikurak 

U.S. Patent No. 6,647,400 to Moran 

U.S. Patent No. 6,681,331 to Munson et al. 
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U.S. PATENTS 

U.S. Patent No. 6,708,212 to Porras et al. 

U.S. Patent No. 6,711,615 to Porras et al. 

U.S. Patent No. 6,792,546 to Shanklin et al. 

U.S. Patent No. 6,816,973 to Gleichauf et al. 

U.S. Patent No. 6,839,850 to Campbell et al. 

U.S. Patent No. 6,912,676 to Gusler et al. 



U.S. Patent Application Publications 

U.S. Patent Application Publication No. 2002/0032717 to Malan et al. 

U.S. Patent Application Publication No. 2002/0032793 to Malan et al. 

U.S. Patent Application Publication No. 2002/0035698 to Malan et al. 

U.S. Patent Application Publication No. 2002/0138753 to Munson 

U.S. Patent Application Publication No. 2002/0144156 to Copeland m et al. 

U.S. Patent Application Publication No. 2003/0088791 to Porras et al. 

U.S. Patent Application Publication No. 2003/0212903 to Porras et al. 

U.S. Patent Application Publication No. 2004/0010718 to Porras et al. 

The Applicant submits that these search terms cannot be interpreted as providing 
emphasis on these terms when the claims are interpreted and construed by both the Examiner and 
the courts. The Applicant merely selected these terms to identify the prior art that may be more 
relevant than prior art that do not contain these search terms. 

To further assist the Examiner, the Applicant has organized each of the U.S. Patents and 
U.S. Patent Application Publications according to classification. For the non-U.S. patent prior 
art, the Applicant has annotated Form PTO-1449 with the location of each document in a 
respective box. 

The Applicant exerted this additional time and effort to help the Examiner so that if a 
patent is ever issued on this patent application, third parties will understand that the Applicant 
submitted the attached prior art on a good faith basis. The Applicant recognizes that the attached 
prior art is voluminous but it is not the Applicant's intent to "bury" any patents that maybe more 
pertinent than other ones. The Applicant does not want to dismiss any reference that he is aware 
of as cumulative in order to prevent third parties from arguing that the Applicant intentionally did 
not submit any prior art in an effort to deceive the Examiner and the Patent Office. 
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This IDS is being filed under 37 C.RR. § 1.97(b)(4), before the mailing of a first Office 
Action after the filing of a request for continued examination 37 C.F.R. § 1.1 14. No certification 
is required. No fee is believed to be due. However, should the Commissioner determine 
otherwise, he is authorized to charge such fees to Deposit Account No. 11-0980. 

If the Examiner has any questions concerning this IDS, he is requested to contact the 
undersigned. If it is determined that this IDS has been filed under the wrong rule, the Patent 
Office is requested to consider this IDS under the proper rule (with a petition if necessary) and 
charge the appropriate fee to Deposit Account No. 1 1-0980. 

Enclosures: Respectfully submitted, 

1. FormPTO-1449 

2. Foreign Patents KING & SPALDING LLP 

3. Publications / a/I 



4. Postcard 
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